1 view
bikini/exploitarium
A single archive of public exploit PoCs and vulnerability research writeups. At the time I post these, none have been reported. Feel free to report them yourself and take credit for the CVE if handed out lulz. Please do not abuse these. I do this so to allure people into the field, and I've always found this is the most efficient way.
Python★ 4,733+230 that day#9 on trending
4.57%duplicated code · 839 of 18,376 lines
38clones in code
82code files of 222 scanned
3.85%duplicated over all files · 62 clones
The code number leaves out tests, fixtures, docs, examples, data files, styles, translations and vendored code.
Largest clones in the code
- 122 lines in 2 placesc788 tokensffmpeg-rasc-dlta-calc-poc/poc/ffmpeg_rasc_dlta_calc_poc.c:53–174ffmpeg-rasc-dlta-calc-poc/poc/ffmpeg_rasc_dlta_calc_poc_portable.c:76–197
53} 54 55static void free_demo_chunk(void *opaque, uint8_t *data) 56{ 57 (void)opaque; 58 av_free(data); 59} 60 61static void put_le16(uint8_t *p, uint16_t v) 62{First 10 of 122 lines.
- 133 lines in 2 placesc640 tokenslibssh2-publickey-list-calc-poc/poc/publickey_win32_heap_groom_calc_repro.c:139–271libssh2-publickey-list-calc-poc/poc/publickey_win64_arbitrary_free_calc_repro.c:159–291
139 newptr = proof_realloc(ptr, count); 140 return newptr; 141} 142 143int ssh2_err(LIBSSH2_SESSION *session, int errcode, const char *errmsg) 144{ 145 if(session) { 146 session->err_code = errcode; 147 session->err_msg = (char *)errmsg; 148 }First 10 of 133 lines.
- 67 lines in 2 placesc401 tokensffmpeg-rasc-dlta-calc-poc/poc/ffmpeg_rasc_dlta_calc_poc.c:174–240ffmpeg-rasc-dlta-calc-poc/poc/ffmpeg_rasc_dlta_calc_poc_portable.c:199–265
174int ret; 175 176if (!codec) { 177 fputs("RASC decoder missing\n", stderr); 178 return 1; 179} 180 181printf("[addr] benign_callback=%p\n", (void *)benign_callback); 182printf("[addr] calc_callback=%p\n", (void *)calc_callback); 183if ((((uintptr_t)benign_callback) >> 24) != (((uintptr_t)calc_callback) >> 24)) {First 10 of 67 lines.
7 more
- 38 lines in 2 placesc193 tokens
- 41 lines in 2 placesc176 tokens
- 27 lines in 2 placesrust167 tokens
- 15 lines in 2 placesc116 tokens
- 15 lines in 2 placesrust109 tokens
- 28 lines in 2 placesc104 tokens
- 10 lines in 2 placesrust103 tokens
Largest clones over all files, tests and data included
- 122 lines in 2 placesc788 tokensffmpeg-rasc-dlta-calc-poc/poc/ffmpeg_rasc_dlta_calc_poc.c:53–174ffmpeg-rasc-dlta-calc-poc/poc/ffmpeg_rasc_dlta_calc_poc_portable.c:76–197
53} 54 55static void free_demo_chunk(void *opaque, uint8_t *data) 56{ 57 (void)opaque; 58 av_free(data); 59} 60 61static void put_le16(uint8_t *p, uint16_t v) 62{First 10 of 122 lines.
- 133 lines in 2 placesc640 tokenslibssh2-publickey-list-calc-poc/poc/publickey_win32_heap_groom_calc_repro.c:139–271libssh2-publickey-list-calc-poc/poc/publickey_win64_arbitrary_free_calc_repro.c:159–291
139 newptr = proof_realloc(ptr, count); 140 return newptr; 141} 142 143int ssh2_err(LIBSSH2_SESSION *session, int errcode, const char *errmsg) 144{ 145 if(session) { 146 session->err_code = errcode; 147 session->err_msg = (char *)errmsg; 148 }First 10 of 133 lines.
- 79 lines in 2 placesmarkupmarkup568 tokensdiscord-activity-stock-client-rce-poc/exploit.html:934–1012discord-activity-stock-client-rce-poc/exploit.html:1397–1475
934const bytes = []; 935const emit = (...values) => { 936 for (const value of values) bytes.push(Number(value) & 0xff); 937}; 938const emitU32 = (value) => { 939 let n = Number(value) >>> 0; 940 for (let i = 0; i < 4; i++) { 941 emit(n & 0xff); 942 n >>>= 8; 943 }First 10 of 79 lines.
- 67 lines in 2 placesc401 tokens
- 29 lines in 2 placesmarkupmarkup222 tokens
By format, code only
| Format | Files | Lines | Clones | Duplicated lines | Duplication |
|---|---|---|---|---|---|
| c | 10 | 3,454 | 18 | 594 | 17.2% |
| rust | 4 | 756 | 12 | 133 | 17.59% |
| python | 35 | 6,945 | 5 | 75 | 1.08% |
| javascript | 7 | 5,122 | 2 | 24 | 0.47% |
| php | 1 | 323 | 1 | 13 | 4.02% |
| bash | 20 | 1,327 | 0 | 0 | 0% |
| perl | 1 | 174 | 0 | 0 | 0% |
| powershell | 1 | 129 | 0 | 0 | 0% |
| cpp | 1 | 87 | 0 | 0 | 0% |
| java | 1 | 46 | 0 | 0 | 0% |
By format, all files
| Format | Files | Lines | Clones | Duplicated lines | Duplication |
|---|---|---|---|---|---|
| markup | 5 | 3,807 | 20 | 361 | 9.48% |
| c | 11 | 3,462 | 18 | 594 | 17.16% |
| rust | 4 | 756 | 12 | 133 | 17.59% |
| python | 35 | 6,945 | 5 | 75 | 1.08% |
| javascript | 7 | 5,122 | 2 | 24 | 0.47% |
| bash | 43 | 1,546 | 2 | 16 | 1.03% |
| markdown | 48 | 7,872 | 1 | 14 | 0.18% |
| text | 32 | 1,087 | 1 | 8 | 0.74% |
| php | 2 | 331 | 1 | 13 | 3.93% |
| txt | 17 | 563 | 0 | 0 | 0% |
Trending appearances
| Day | Rank | Stars | Files | Lines | Clones | All files | Code | Health | Commit |
|---|---|---|---|---|---|---|---|---|---|
| Sep 6, 2026 | #9 | 4,733 (+230) | 222 | 32,165 | 62 | 3.85% | 4.57% | — | cdcbe77 |
| Sep 5, 2026 | #5 | 4,556 (+74) | 222 | 32,165 | 62 | 3.85% | 4.57% | — | cdcbe77 |
Want this for your own project? Install jscpd and run jscpd ., or measure it the way the baselines were measured.